Skip Phase 3 (Security Review) depth — basic guardrails only. Don’t let security theater block shipping.
Phase 4 (Cost Estimate) matters more than Phase 2 (Design) at this stage. A $500/mo surprise kills a pre-seed startup.
Deliver the simplest architecture that validates the hypothesis. If it’s a single Lambda + DynamoDB, that IS the plan.

Full workflow applies but bias toward speed over perfection
Security Review: focus only on data exposure risk (public S3, no auth) — skip compliance depth until Series A
Cost Estimate: model the “what if we 10x” scenario — will your architecture bankrupt you at success?

Over-engineering for hypothetical scale: You have 50 users. Lambda + DynamoDB. Not EKS. Not multi-region. Not event sourcing. The startup that builds for 10M users at 50 users usually dies at 50 users.
Skipping cost modeling because “we have credits”: Credits expire. Model what happens when they run out. If your architecture costs $15K/mo and credits cover $5K, you have 3 months of runway buffer, not infinite time.
Proposing services the team cannot operate: A 3-person startup cannot operate Kubernetes, Kafka, and a data lake simultaneously. Each managed service you skip saves 20% of one engineer’s time.
Building the “enterprise-ready” version first: SOC2, multi-tenant isolation, audit logging — all matter, but not before you have 10 paying customers. Build the path TO compliance, don’t implement it day 1.

Trap	Why It Hits Startups Hard
NAT Gateway ($32/mo + data)	Often unnecessary pre-PMF. Use VPC endpoints or public subnets with security groups
Multi-AZ RDS ($200+/mo minimum)	Single-AZ is fine until you have SLA commitments to paying customers
Secrets Manager ($0.40/secret/mo)	Use SSM Parameter Store SecureString (free) until you need rotation
CloudWatch Logs (never-expire default)	Set 30-day retention. You won’t look at 6-month-old dev logs
ECS + ALB baseline	$50/mo minimum even at zero traffic. Consider Lambda until steady-state traffic justifies it

Current Choice	Graduate When	Graduate To
Single Lambda + DynamoDB	p99 latency matters AND traffic is steady (not spiky)	ECS Fargate + Aurora
Single-AZ RDS	First paying customer with uptime SLA	Multi-AZ RDS
No IaC (console clicks)	Second engineer joins OR you need a second environment	CDK or Terraform
Single AWS account	First production customer	Prod + Dev accounts minimum
No monitoring	First production customer	CloudWatch dashboards + 3 alarms (errors, latency, cost)

references/aws-plan.md